This document describes in depth how to prepare your Buffalo LinkStation for installing NetBSD/sandpoint. In this example we use a LinkStation HD-HLAN, which is the same board as a classic KuroBox. The software installation instructions are valid for the whole LinkStation/KuroBox family:

LinkStation HD-HLAN (LS1/PPC)

LinkStation HD-HGLAN (Gigabit ethernet)

TeraStation HD-HTGL

TeraStation Pro TS-TGL

KuroBox classic (HD-HLAN board)

KuroBox HG (HD-HGLAN board)

KuroBox/T4 (TS-TGL board)

Accessing the serial interface
==============================
We need a serial console to get access to the firmware. That includes
soldering a four pin header onto the board and building (or buying) a
serial adapter from the LinkStation's TTL levels to RS232 levels.
Disassemble the HD-HLAN
-----------------------
Unfortunately the LinkStation was not meant to be opened by customers,
so Buffalo didn't make it easy. On the top and bottom of the case there
is a small tab besides the grey frame, which you have to press down
(e.g. with a screwdriver) to be able to move the frame to the front. On
the photo below the location is marked red.
After a few millimeters the grey piece snaps free and comes up. You need
quite some force to do that, because the shiny front bezel is secured by
two hidden screws (one in the top and another in the bottom of the
bezel). With enough force and skill you may be able to tear the screws
out of the case (fortunately the screws are small). They remain in the
shiny bezel. You may want to shorten the screws with a file now.
Before the case can be opened you have to remove a screw hidden under a
sticker, below the fan (marked on the right side of the picture). Then
press the four tabs on the top and bottom to remove the upper half of
the case. Remove another four screws to be able to lift the board.
Locate the serial header
------------------------
Look out for a 4-pin header, called `J1`, which is usually unpopulated.
The pin assignments are:

Pin number

Function

1

TXD

2

RXD

3

3.3V

4

GND

Solder the missing header and enable write access
-------------------------------------------------
I would suggest to solder the 4-pin header on the back side of the PCB,
because it is better accessible when opening the case. It is advisable
to use an angled header to avoid problems closing the case. You also
have to bridge `R76`, which is unoccupied. This is needed to enable
write-access for the serial console. You may want to mark pin 1 of the
header, before installing the board again.

Connect a serial cable
----------------------
The serial port on LinkStation and KuroBox devices is using 3.3V TTL
levels, which have to be converted into regular RS232 levels by a level
shifter circuit. If you are not anxious using a soldering iron you find
detailed instructions how to build such a converter here:
- [Serial adapter for 3.3V TTL](http://www.netbsd.org/ports/sandpoint/ttl2rs232.html)
Make sure that the layout of the plug fits to the pinout of the
LinkStation's serial header, as shown above.
Another option is to buy such a converter. There are solutions for a
standard RS232 interface and for an USB interface. Look out for:
- RS232 level shifter / breakout board (MAX3232 based)
- USB to TLL serial level shifter / breakout board (FT232 based)
Now you can connect with any terminal program to the LinkStation's
serial console. The easiest approach may be to use NetBSD's `tip(1)` command
to make a direct console connection at 57600bps.
# tip -57600 console
Note that when using a serial connection via USB you may have to make an
entry for `/dev/ttyU0` in `/etc/remote`.
Replace the firmware with U-Boot
================================
The LinkStations run with a proprietary firmware, which doesn't give you
any control about the boot process. So our next step is to replace it
with [U-Boot](http://www.denx.de/wiki/U-Boot/).
Getting root access
-------------------
We need root access on the vendor's Linux installation to be able to
flash a new firmware. Without the original disk it will become much more
difficult. You would either have to find a way to install the system
onto a new disk with the help of a second machine, or use the JTAG port
to flash the new firmware directly into the chip (in the last case you
can skip all sections until
[the section called “First installation”](#install) ).
For the KuroBox you can skip this section. The root password is known to
be `kuro`. Also telnet access is enabled. The default IP of the KuroBox
is `192.168.11.150`.
Make a new user over the LinkStation's web interface. We can use it to
log in over the serial port.
Log in into the new account and create a CGI file under `/www` which
makes `/etc/passwd` writeable for all users.

`exploit.cgi` should look like this:
#!/bin/sh
chmod 666 /etc/passwd
Then enter the URL `http://mylinkstation/cgi-bin3/exploit.cgi` into your
browser. When all went well, `/etc/passwd` is writeable now. Edit it
with **vi** and copy your user password (`/Jg58Gq9427qY` in this example)
over the current root password. Now you can log in with the same
password into the root account.
root:dwqa1LabM8BgA:0:0:root:/root:/bin/bash
bin:*:1:1:bin:/bin:
daemon:*:2:2:daemon:/usr/sbin:
sys:*:3:3:sys:/dev:
adm:*:4:4:adm:/var/adm:
sync:*:6:8:sync:/bin:/bin/sync
shutdown:*:7:9:shutdown:/sbin:/sbin/shutdown
halt:*:8:10:halt:/sbin:/sbin/halt
operator:*:12:0:operator:/root:
ftp:*:15:14:ftp:/usr/sbin:/bin/false
nobody:*:99:99:nobody:/home:/bin/sh
Besucher:/Jg58Gq9427qY:101:1000::/home:/bin/bash
The CGI exploit, which I described above, probably does not work with
all Linkstation firmware releases. It may fail with versions after 1.45.
I was able to do it with 1.47 though. An alternative to this method
would be to connect the hard disk to a second machine, which can mount
the Linux file system, and replace the root password there.
Flashing U-Boot
---------------
To transfer the new firmware onto the LinkStation we first have to
configure FTP access (already enabled for KuroBox). Enable the server
and allow write access for registered users to the shared folders (e.g.
`share`).
Get an appropriate U-Boot firmware image from
(URL is obsolete, use copies below):
- [LinkStation HD-HLAN or KuroBox classic](http://www.netbsd.org/~phx/LinkStation/u-boot-hd.flash.bin)
- [LinkStation HD-HGLAN or KuroBox HG](http://www.netbsd.org/~phx/LinkStation/u-boot-hg.flash.bin)
Transfer the firmware into the `share` folder on the LinkStation.

The next step is dangerous. Any fault, like a wrong firmware or an
interrupted flashing process, will turn your LinkStation into a brick.
The boot loader firmware can be accessed from Linux through `/dev/fl2`.
There is no **dd** so we will use **cat**. Log in as root on the serial
console, go to the shared folder where we uploaded the new firmware and
flash it.

The Diag and Disk Full LEDs will flash red during this process. This is
normal. After a few seconds the LEDs are off again and the prompt
returns. To make sure the process was successful, you should reread the
firmware from the flash and compare it with the original. Therefore you
have to download the new image, as this Linux installation also got no
**cmp**.

root@BUFFALO:/mnt/share# cat /dev/fl2 > /mnt/share/newfl2

Here the downloaded image differs at character 174641. But that is ok,
because the firmware is only 174640 bytes large and we downloaded the
whole flash contents.

Enter **reset** to reboot into interactive mode with serial console. At
this point we no longer need the original Linux installation and we are
ready for NetBSD.
First installation
==================
The altboot bootloader
----------------------
The `altboot(8)` program functions as a bridge between the U-Boot
firmware and the NetBSD kernel startup environment. NAS firmware often
provides no means to boot a kernel from disk or from the network and
doesn't initialize all hardware correctly. We will also use it to pass a
bootinfo list to the kernel.
The `altboot` boot loader has to be loaded and started using U-Boot. For
the first installation we have to load it over the network with TFTP
protocol, using the command **tftpboot**. Later we can put `altboot` into
the flash memory and copy it from there.
When not already done, enable TFTP on your working system in
`/etc/inetd.conf` and restart `inetd`. Then copy `altboot.bin` from the
sandpoint distribution into `/tftpboot`. On the LinkStation we have to
tell U-Boot its client address and the `tftpd` server address. Our
working system's server address is `192.168.0.5` in this example, and
the LinkStation is at `192.168.0.102`.

Boot the INSTALL kernel with altboot
------------------------------------
Now you can use `altboot` to launch the `netbsd-INSTALL_KURO` kernel for
installing NetBSD. It is important to take `netbsd-INSTALL_KURO` instead of
`netbsd-INSTALL`, because LinkStation and KuroBox systems have the UARTs
swapped, i.e. they are using the second UART for the serial console. You
may choose to load the installation kernel with TFTP or from NFS. TFTP
was described above and for NFS there is a documentation at
[The Network File System](http://www.NetBSD.org/docs/guide/en/chap-net-services.html#chap-net-services-nfs).
But in both cases you have to set up a DHCP server, which is explained
in the [DHCP Howto](http://www.NetBSD.org/docs/network/dhcp.html). An
appropriate `dhcpd.conf` entry could look like this:
host linkstation {
hardware ethernet 00:07:40:xx:xx:xx;
fixed-address 192.168.0.102;
next-server 192.168.0.5;
option root-path "/export/linkstation/root";
}
The `root-path` option is only needed when using NFS and should match
your exported NFS directory. Uncompress `netbsd-INSTALL_KURO.gz` from
the NetBSD/sandpoint distribution and copy it into the NFS or TFTP
directory. Then start the DHCP, NFS or TFTP server and boot the
installation kernel from the firmware either with